CN1553341A - Client-based Network Address Assignment Method - Google Patents

Abstract

The invention provides a network address allocation method based on a client. A user applies for a network address to access a network; an access server allocates a network address of a first network to the user and allocates resources of the user according to its configuration information; the user initiates an authentication request; The access server authenticates the user and returns the authentication result; the client refreshes the user's network address according to the authentication result; the access server applies for the network address of the second network and assigns it to the user according to the authentication result. The present invention saves public network address resources by allocating a network address before authentication and then allocating a network address after authentication, and can select corresponding strategies according to user authentication information; user messages do not need to go through Special handling of any device can be sent, supporting any protocol.

Description

Client-based Network Address Assignment Method

technical field

The invention relates to a network access method, in particular to a method for assigning network addresses when users access the network.

Background technique

IP address resources are one of the most valuable resources in network resources. If a computer wants to connect to the network, it needs to obtain an IP address, which is unique in the world and distributed uniformly around the world. Therefore, with the rapid development of the Internet, With development, IP address resources are becoming more and more tense. When building a LAN, the IP address of the host inside it can be planned internally, which is called a private network IP address; when building a wide area network, the IP address is planned globally by the address planning department, and is called a public network IP address. Since private network IP addresses are planned internally, the resources are relatively abundant; while public network IP addresses are used in the WAN and allocated globally, so address resources are very tight.

At present, one method to solve the shortage of public network IP address resources is to use Network Address Translation (NAT for short) technology, also known as address proxy, which is used to realize the conversion between private network IP addresses and public network IP addresses, so that Multiple private network IP addresses correspond to one public network IP address, achieving the purpose of saving public network IP address resources.

The Internet Address Assignment Organization stipulates that the following three network address segments are reserved for private network IP addresses: 10.0.0.0-10.255.255.255; 172.16.0.0-172.31.255.255; It will not be distributed on the Internet and can be used within a local area network. Each LAN can choose an appropriate network address according to the number of hosts it contains. The internal network addresses of different LANs can be the same. If a LAN selects a network segment other than the above three network address segments as the internal network address, it may cause confusion in the routing table.

When a host in a local area network accesses the Internet or communicates with a host in an external network, it needs to go through network address translation.

FIG. 1 is a schematic diagram of a host in a local area network accessing an external network host. The address of the internal network of the LAN is the 10.0.0.0 network segment, the IP address of the host 1 is 10.1.1.10, and the IP address of the host 2 is 10.1.1.48. Each host is connected to the external network through the proxy server 203.196.3.23, so the external network of the LAN The official IP address is 203.196.3.23. When the host 2 inside the local area network accesses the WWW server 202.18.245.251 located outside the local area network in www mode, the host 2 first sends a data packet, in which the source port is 6084 and the destination port is 80. After passing through the proxy server, the source address and port of the data packet are changed to 203.196.3.23:32814, and the destination address and port remain unchanged. When the WWW server of the external network returns the result, the proxy server will convert the destination IP address and port in the result data message to 10.1.1.48:6084 according to its internal address-port correspondence table, so that the internal host 2 can access the external server.

Adopting the NAT method will bring the following problems. First of all, because NAT needs to convert the IP address of the data message, it cannot encrypt the header of the data message involving the IP address, so that the encrypted file transfer protocol FTP cannot be used to connect, because this will cause the port in the FTP protocol Command could not be converted correctly. Secondly, when a host in a certain internal network attacks other networks, it is difficult to detect which host sends the attack, because the IP address of the host is shielded, which brings difficulties to network security detection. Third, since each data message of the internal network host needs to be processed by NAT, the efficiency of message forwarding is greatly affected. Fourth, when the domain name resolution server (DNS for short) is located outside the LAN, users on the internal network cannot access other users on the internal network through the domain name, as shown in Figure 2. When connecting to the FTP server of the network, it will first request an IP address from the external DNS. Since the DNS is located in the public network, it will return a public network address or cannot find the address, which will cause the host on the internal network to access the internal network through the domain name. When using a server, the address of the server on the public network is obtained or the address cannot be obtained, which causes internal users to be unable to access the internal server normally.

Users can also use authentication to access external networks. Currently, a commonly used authentication method is WEB authentication. When performing WEB authentication, there is no need to install the client, and the browser can be used directly. The network diagram of the system using WEB authentication is shown in Figure 3. The user is connected to the broadband access server BAS through a layer 2 device (L2 for short). L2 can be a HUB, a LAN switch, etc., and accesses the core network through the BAS; the AAA server and WEB server are also respectively connected to the core network. The process of WEB authentication is as follows: the user obtains the IP address through the dynamic address allocation protocol DHCP or configures the IP address statically, and then accesses the WEB server to obtain the authentication page; the user enters the user name and password, and submits the authentication request; the WEB server communicates with the BAS Interactive authentication; BAS obtains the user name and password from the WEB server, and performs authentication and accounting for the user; the WEB server notifies the user of the success or failure of going online. Since the user needs to obtain an IP address before WEB authentication, and the IP address will not be replaced after the authentication is passed, the public network IP address is allocated before the authentication, wasting IP address resources.

For other authentication methods, such as dial-up authentication that meets 802.1x, you can also obtain an IP address through DHCP first, and then perform dial-up authentication, so there will also be a problem of wasting public network IP address resources.

Contents of the invention

The technical problem to be solved by the present invention is to provide a network address allocation method based on the client, which is used to solve the problem of shortage of public network IP address resources, and realize the switching between different networks for users, so that users can obtain network addresses. Send and receive data packets directly.

The client-based network address allocation method of the present invention, in the process of user authentication, assigns a network address to the user before authentication, and assigns another network address after authentication, so that network resources can be used reasonably; the method Include the following steps:

Step 1, the user applies for a network address to access the network;

Step 2, the access server allocates the network address of the first network to the user, and allocates user resources;

Step 3, the user initiates an authentication request;

Step 4, the access server authenticates the user and returns the authentication result;

Step 5, the client refreshes the user's network address according to the authentication result;

In step six, the access server applies for a network address of the second network and assigns it to the user.

Wherein, the network address of the first network may be a network address of a private network or a network address of a public network; the network address of the second network is a network address of a public network.

The access server is preferably a broadband access server.

The present invention effectively saves public network IP address resources by allocating a network address before authentication, refreshing the address after authentication, and allocating another network address, and can select corresponding strategies according to user authentication information. For example, users user1 and user2 are assigned addresses by the private network DHCP server before authentication. After authentication, user user1 can assign addresses from the DHCP server 1 of the operator ISP1, while user user2 can assign addresses from the DHCP server 2 of the operator ISP2. Allocate addresses in the network, so that address resources can be allocated according to user authentication results. Secondly, after using the method of the present invention for authentication, the user's message can be sent without special processing by any device, which is more efficient than using NAT technology, and does not require special processing of the address information in the message, supporting any agreement. In addition, the invention also enhances the management function of the access server, making the networking more flexible.

Description of drawings

Fig. 1 is a schematic diagram of a network in which a host in a local area network uses NAT technology to access an external network;

Fig. 2 is the network schematic diagram that the main frame of internal network accesses FTP server through domain name;

Fig. 3 is a schematic diagram of a network using a WEB authentication method;

Fig. 4 is the flowchart of the network address assignment method of the present invention;

Fig. 5 is a schematic diagram of network networking of specific embodiment 1 of the method of the present invention;

Fig. 6 is a schematic diagram of the business process of Embodiment 1 of the method of the present invention;

Fig. 7 is a schematic diagram of the business process of Embodiment 2 of the method of the present invention.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings and embodiments.

FIG. 1 to FIG. 3 are schematic diagrams of networks applying the prior art, which have been described in detail in the background technology section, and will not be repeated here.

In order to solve the existing problems in the prior art, the basic idea of the client-based network address allocation method of the present invention is to allocate a network address to the user before authentication, and allocate another network address after authentication, so that network resources can be used reasonably. In order to save public IP address resources, users are generally assigned private IP addresses before authentication and public IP addresses after authentication; public IP addresses can also be assigned, but according to different user policies before and after authentication, the Realize users switching between different Internet service providers ISP.

The client-based network address allocation method of the present invention can adopt multiple authentication methods, for example, it can be combined with WEB authentication, and can also be combined with some kind of dial-up authentication. The following takes the network address allocation combined with the above two authentication methods as an example to describe in detail.

Specific embodiment 1:

The typical network of client-based WEB authentication network address allocation is shown in Figure 4. WEB users access the broadband access server BAS through the layer 2 device L2, BAS, portal server (Portal server for short), and remote authentication server (Radius for short). Server), dynamic address assignment server (referred to as DHCP server) 1 and DHCP server 2 are all connected to the network, wherein DHCP server 1 is a DHCP server of a private network, and DHCP server 2 is a public network DHCP server, which can be built into the BAS The address pool used by the Portal server to provide web authentication pages. The communication with the DHCP server adopts the DHCP protocol; the communication with the Radius server adopts the radius protocol; the communication with the Portal server adopts the portal protocol.

As shown in Figure 5, the business flow chart of client-based WEB authentication network address assignment, the user applies for an IP address through the DHCP protocol, the DHCP message is intercepted by the BAS, and the configuration information in the BAS includes how to handle a user request to assign an IP address. Address request, to which DHCP server to apply for an address, for example, specifying a user with a virtual LAN tag VLAN ID from port 1 in the BAS device to apply for an address from the DHCP server 10.0.0.2; a user from port 2 without a virtual LAN tag VLAN ID The user applies for an address from the DHCP server 11.0.0.2. After receiving the DHCP message, the BAS selects the specified private network DHCP server 1 for the user according to its configuration information, and acts as a DHCP relay to apply for an IP address from the DHCP server 1 to obtain a private network IP address; or the BAS can also Select an address for the user from its internal address pool.

While allocating addresses for users, the BAS device also allocates resources for users, such as user entries, address resolution protocol entries, user logs, flow matching tables, etc., and adds user policies, which include permissions assigned to users, for example Which websites can be accessed, which websites cannot be accessed, what is the user's traffic limit, what services are allowed to the user, etc., access control list ACL, broadband address restriction CAR, user priority, quality of service QOS, etc., for example, "allow access to Portal server and web site 1, cannot access web site 2; when a user accesses a web site that is not allowed to access, the user is forced to access the Portal server", so that the user can only access the specified address before authentication, such as the PORTAL server or DNS server. Therefore, for the above user policy, if the user visits web site 2 before authentication, he will be forced to visit the Portal server; if the user visits web site 1, he will be allowed to access.

The user starts the browser, accesses the Portal server, and obtains the authentication page; if the user accesses other addresses that are not allowed to be accessed, the BAS forces the user to access the Portal server, and obtains the authentication page. After the user enters the user name and password, the user submits an authentication request, which is sent to the Portal server through the HTTP protocol for analysis. The Portal server interacts with the BAS through the Portal protocol, so that the BAS obtains the user name and password. The BAS judges whether to perform local authentication or radius authentication according to the suffix of the user name. If it is to perform radius authentication, it sends the user name and password to the Radius server through the radius protocol. If they match, the authentication succeeds, otherwise the authentication fails; if local authentication is performed, the user's username and password are matched with the locally configured username and password, if they match, the authentication succeeds, otherwise the authentication fails; After the end, the authentication result will be generated. The authentication result needs to include whether the address needs to be assigned again, and also includes the authorization information of the user, such as broadband address limit CAR, the user's remaining online time, user priority, etc. The BAS notifies the Portal server of the authentication result through the Portal protocol. If the authentication is successful and another address allocation is required, the Portal server will issue the authentication result page and client applets, such as JAVA APPLET, ACTIVEX, etc., and the client applet will refresh the user IP address and release the original private network IP address first. , and then apply for a new IP address. After the BAS obtains the message that the user applies for a new IP address, it goes to the designated public network DHCP server 2 to apply for a public network address according to the authorization information included in the user authentication result, and returns the applied public network address to the user. After the user obtains the public network address, the BAS notifies the Portal server that the user's IP address has changed through the Portal protocol, and releases the user's private network address after receiving an address change confirmation response. BAS refreshes the user policy for the user, such as "Allow access to any address, but force access to the Portal server when accessing the webpage for the first time", so that the user can access the specified public network address. So far, the online process of client-based network address allocation is completed. According to the new user policy, when the user visits the web site 2 for the first time after authentication, he is forced to visit the Portal server; when he visits the web site 2 for the second time, the access is allowed. When the user goes offline, the public IP address is released.

Specific embodiment 2:

The network networking based on client-side dial-up authentication network address allocation can also adopt the structure shown in Figure 4, because it is dial-up authentication, so the Portal server may not be needed. The business flow chart is shown in Figure 6. The user applies for an IP address through the DHCP protocol. The DHCP message is intercepted by the BAS. The BAS selects the specified private network DHCP server 1 for the user according to the configuration information. The BAS acts as a DHCP relay to apply for an address from the DHCP server 1; Select an address from the configured internal address pool for the user.

While allocating private network addresses for users, BAS internally allocates resources for users and adds user policies, such as "you can access web site 1, but cannot access web site 2; when users access addresses that are not allowed to access, they are forced to web site 1." , modify the access control list ACL, so that the user can only access the specified address before authentication. For this policy, before authentication, if the user visits web site 2, he is forced to visit web site 1; if the user visits web site 1, his access is allowed.

The user enters the user name and password to dial. BAS determines whether it is local authentication or radius authentication according to the suffix of the user name. If it is radius authentication, it will send the user name and password to the radius server through the radius protocol to authenticate the user; if it is local authentication, it will use the user name and password locally. Authenticate the user. After the authentication is completed, an authentication result is generated. The authentication result needs to include the attribute of whether to re-allocate the address, as well as the user's authorization information, such as the broadband address limit CAR, the user's remaining online time, and user priority. The BAS notifies the client of the authentication result, and the dialer refreshes the user's IP address according to the authentication result, first releases the original IP address, and then applies for a new IP address. According to the authorization information in the user authentication result, the BAS goes to the designated public network DHCP server 2 to apply for a public network address, returns the new public network address to the user, and releases it to the user's private network address. BAS refreshes the user policy for the user, such as "allow access to people and addresses, but must be forced to web site 1 when accessing the web page for the first time", and modifies user attributes, such as ACL, so that the user can access the specified public network address. So far, the online process of client-based network address allocation is completed. When the user visits the webpage for the first time, he is forced to visit web site 1; when he visits web site 2 for the second time, he is allowed to visit. The public IP address is released when the user goes offline.

In the above two embodiments, the network addresses assigned before the authentication are all private network IP addresses, and the public network IP addresses are assigned after the authentication. In practice, the network addresses before and after authentication can also be public IP addresses, so as to realize switching between different ISPs for users. For example, the user belongs to operator 1 by default before authentication, and its network address is allocated by operator 1, and the websites that can be accessed are also specified by operator 1. If the user needs to switch operators, he needs to be authenticated by operator 2 to obtain the authority granted by operator 2. Therefore, after the authentication is passed, the network address allocated by operator 1 should be released and the address allocated by operator 2 should be applied.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention without limitation. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be Modifications or equivalent replacements of the technical solutions without departing from the spirit and scope of the technical solutions of the present invention shall be covered by the scope of the claims of the present invention.

Claims (14)

1. A client-based network address allocation method, characterized in that, comprising the following steps: Step 1, the user applies for a network address to access the network; Step 2, the access server allocates the network address of the first network to the user, and allocates user resources; Step 3, the user initiates an authentication request; Step 4, the access server authenticates the user and returns the authentication result; Step 5, the client refreshes the user's network address according to the authentication result; In step six, the access server applies for a network address of the second network and assigns it to the user. 2. The client-based network address assignment method according to claim 1, wherein the network address of the first network is a network address of a private network; the network address of the second network is a network address of a public network . 3. The client-based network address assignment method according to claim 1, characterized in that, both the network address of the first network and the network address of the second network are network addresses of a public network. 4. The client-based network address allocation method according to claim 2 or 3, characterized in that in said step 2, the access server applies for a network address from the dynamic address allocation server of the first network, and allocates it to user. 5. The client-based network address allocation method according to claim 2 or 3, characterized in that, in the second step, the access server selects an address for the user from its internal address pool. 6. The client-based network address assignment method according to claim 1, characterized in that said step 2 further includes the step of adding a user policy to the user while assigning the network address to the user, wherein the user policy is at least It includes permissions assigned to users, and the permissions at least include addresses that are allowed to be accessed, addresses that are not allowed to be accessed, traffic restrictions for users, and services that are allowed to be carried out. 7. The client-based network address assignment method according to claim 1, wherein said step 4 further comprises: the user name and password input by the user are sent to the access server; the access server, according to the suffix of the user name, Determine whether to perform remote user login radius authentication or local authentication. If it is radius authentication, send the user name and password to the remote authentication server through the Radius protocol. The remote authentication server performs authentication, and the obtained authentication result is returned to the receiving If the local authentication is performed, the user name and password of the user will be authenticated locally to obtain the authentication result; if the address needs to be reassigned, the access server will notify the client that the authentication is successful and the address needs to be reassigned. 8. The client-based network address allocation method according to claim 7, wherein the authentication result at least includes the attribute of whether re-allocation of the address is required and the authorization information of the user. 9. The client-based network address assignment method according to claim 7, wherein the authentication method adopts WEB authentication or dial-up authentication. 10. The client-based network address assignment method according to claim 9, characterized in that, for WEB authentication, the authentication process further includes: the user name and password input by the user are first sent to the portal server for analysis, and the portal server passes The Portal protocol sends the user name and password to the access server; after obtaining the authentication result, the access server notifies the portal server, and the portal server returns the authentication result to the client. 11. The client-based network address assignment method according to claim 10, characterized in that the method further comprises the step of the access server notifying the portal server that the user's network address has changed after the user obtains the network address of the second network . 12. The client-based network address assignment method according to claim 1, characterized in that, in step five, the client uses the JAVA APPLET or ACTIVEX program to refresh the user's network address, that is, release the original network address first, and then apply for new network address. 13. The method for allocating network addresses based on clients according to claim 1, wherein said step six further comprises modifying user policies while allocating network addresses to users. 14. The client-based network address assignment method according to claim 1, further comprising the step of releasing the network address of the second network when the user goes offline.

Images